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Introduction 


The purpose of this report is to document the results of a high-level qualitative study that was 
conducted to identify future aviation safety risks and to assess the potential impacts to the 
National Airspace System (NAS) of NASA Aviation Safety research on these risks. Multiple 
external sources (for example, the National Transportation Safety Board, the Flight Safety 
Foundation, the National Research Council, and the Joint Planning and Development Office) 
were used to develop a compilation of future safety issues/risks, also referred to as “future tall 
poles.” The primary criterion used to identify the most critical future safety risk issues was that 
the issue must be cited in several of these sources as a safety area of concern. 

The qualitative identification and assessment of future safety risk areas was initially 
conducted in April 2010 (Ref. 1). This report presents a re-evaluation of the critical areas of 
future safety risk in the air transportation system based on updated information and new 
developments that have occurred over the past three years. Although updates and modifications to 
the original study have been made, much of the earlier analysis of future risk remains pertinent 
and applicable today. Two of the original “tall poles” have been renamed. “Super Density 
Operations” has been changed to “Loss of Separation/Near Midair Collision.” Super Density 
Operations is a NextGen operational concept, whereas Loss of Separation/Near Midair Collision 
more accurately reflects the accident/incident threat introduced by increased air traffic and new 
technologies and operational procedures in the NextGen environment. “Inadequate Protection, 
Analysis, and Dissemination of Safety Data” has also been changed to “Vulnerability Discovery, 
Data Sharing and Dissemination.” This change was made indicate that this “tall pole” does not 
only address global data sharing and dissemination; it also emphasizes data mining and analysis 
for the continued monitoring of current safety risks and the prognostic identification of emerging 
safety issues. In addition, two of the original “future tall poles’—Approach and Landing 
Accident Reduction and Aircraft Mixed Fleet Equipage—have been eliminated; however, they 
are properly accounted for as causal factors in the Loss of Control—In Flight and Loss of 
Separation/Near Midair Collision safety risk types, respectively. 

The “tall poles” in future safety risk, in no particular order of importance, are as follows: 


Runway Safety 

Loss of Control—In Flight 

Icing/Ice Detection 

Loss of Separation/Near Midair Collision 

Human Fatigue 

Increasing Complexity and Reliance on Automation 
Vulnerability Discovery, Data Sharing, and Dissemination 
Enhanced Survivability in the Event of an Accident 
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Runway Safety 


Despite a significant reduction in catastrophic airport accidents during the past two decades, 
runway safety is still one of the most significant safety concerns in commercial aviation. The area 
of runway safety encompasses runway incursions, runway excursions, and runway confusion 
(takeoffs/landings on wrong runway or taxiway). 

The number of runway and taxiway incursions being experienced remains unacceptably high 
despite recent efforts to minimize their occurrence. While a number of initiatives have been 
undertaken to mitigate the risks associated with runway incursions, the trend remains flat in specific 
countries, most notably the United States. According to the International Air Transport Association 
(IATA), the majority of incursions are related to communications issues, suggesting that the use of 
standard International Civil Aviation Organization (ICAO) phraseology and improved proficiency 
in the use of aviation English are key factors to reducing the incidence of these events. In addition, 
workload and distractions within the flight deck during the pre-flight phase have been identified as 
contributing factors. Improvements in airport surface markings and lighting, along with more 
accurate charting of airport infrastructure, have been implemented at many locations. Nevertheless, 
runway incursions are expected to remain as a critical safety risk in the future. 

The National Transportation Safety Board (NTSB), as it has in years past, has recently 
highlighted runway safety as a critical safety issue by including “Improve Safety of Airport 
Surface Operations” on its latest Most Wanted List (Ref. 2). They have recommended 
implementing a safety system for ground movement that will ensure the safe movement of 
airplanes on the ground and provide immediate warnings of probable collisions/incursions 
directly to flight crews in the cockpit. Another potential solution to prevent runway incursions is a 
system of cross-checking the airplane’s location at the assigned runway before preparing for 
takeoff. New technology, such as runway status lights and enhanced final approach runway 
occupancy signals, can provide a direct warning capability to the cockpit, thereby eliminating the 
delay in warning the pilots by relaying it through an air traffic controller. The NTSB also cites 
pilot training as a critical factor to improving the safety of aircraft operations on the airport 
surface. They suggest that flight simulator training programs should include realistic conditions, 
such as gusty crosswinds, to prepare pilots for actual conditions before they experience them. 
These resources would not only assist the pilot in ensuring takeoff at the correct runway, but also 
in addressing the confusion factor that is often associated with undesirable airport surface events, 
such as wrong runway departures and taxiway landings. Finally, the NTSB notes that air traffic 
controllers and ground operations staff also play a critical role in ensuring safe airport surface 
area operations. Air traffic controllers could provide pilots with additional information, such as 
the maximum winds that might be encountered during takeoff or landing, allowing them to make 
better informed decisions on runway use. Air traffic control could also develop and apply a robust 
program to select a runway that accounts for current and projected weather and wind conditions. 
A runway utilization plan, using current and projected weather and wind as the primary factors 
for runway selection, would contribute to safer airport surface operations. 

The Flight Safety Foundation (FSF) conducted a project entitled Runway Safety Initiative 
(RSJ) to address the challenge of runway safety. The RSI Team consisted of about 20 organizations 
from around the world, including operators, manufacturers, air navigation service providers, pilot 
groups, and various other industry associations. After reviewing all areas of runway safety, the 
RSI Team primarily focused on reducing the risk of runway excursions since it was found that 
97 percent of runway accidents were caused by excursions (Ref. 3). A runway excursion occurs 
when an aircraft on the runway surface departs the end or the side of the runway surface. Runway 
excursions can occur on takeoff or landing. They consist of two types of events: A veer-off, in 
which an aircraft departs the side of a runway, and an overrun, in which an aircraft departs the 
end of a runway. Runway excursion risk reduction strategies developed by the RSI Team 
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emphasized stabilized approaches and reducing risk of flight crews landing long and fast, with a 
tailwind, on a contaminated runway. 

Runway excursions are a continuing safety concern. The Joint Implementation Measurement 
Data Analysis Team (JIMDAT) of the Commercial Aviation Safety Team has studied worldwide 
fatal and hull loss accident data over the period from 1987 to 2011 and has found that runway 
excursions have exhibited an upward trend. The FSF also found that over the past 15 years, there 
had been almost 30 excursions per year for commercial aircraft (over 25 percent of all accidents). 
The study also noted that although the percentage of excursions that included fatalities was low, 
the sheer number of excursions still meant that there were a high number of fatalities. 
Independent of the FSF effort, the International Air Transport Association’s Safety Group had 
identified runway excursions as a significant safety challenge to address. For this reason, runways 
excursions have been identified as a future aviation safety risk area. 

An increased number of aircraft in the air transportation system not only increases the aircraft 
density in the air, but also on the ground. To address this increased demand, research needs to 
develop systems that improve pilot and controller awareness of airport surface conditions (aircraft 
locations, ground vehicle locations, runway occupancy, and pavement conditions), particularly in 
low-visibility situations. Improving the situational awareness of flight crews and ground 
controllers is critical to reducing incidents and accidents on the ground (Ref. 4). ICAO considers 
Enhanced Safety and Efficiency of Surface Operations to be a key future Performance 
Improvement Area. They specifically mention that cockpit improvements to enhance surface 
situational awareness, including surface moving maps with traffic information, runway safety 
alerting logic, and enhanced vision systems for low visibility taxi operations, should be 
developed. Safety benefits include a reduced risk of collisions and improved response times to 
correction of unsafe surface situations (Ref. 5). 


Loss of Control—In Flight 


Loss of Control—In Flight (LOC-I) involves accidents that occur during airborne phases of 
flight where aircraft control was lost. Loss of control can occur during either Instrument 
Meteorological Conditions (IMC) or Visual Meteorological Conditions (VMC). Occurrences 
involving configuring the aircraft (e.g., flaps, slats, on-board systems, etc.) are also considered 
loss of control. The loss of control during flight may occur as a result of a stall, an icing-related 
event, a severe atmospheric turbulence or wake vortex encounter, or a system/component 
malfunction or failure that does not render the aircraft uncontrollable. 

Aircraft stall leading to loss of control can have a number of contributing factors, including 
failure of the flight crew to follow the approach to stall procedures due to inadequate training, 
lack of flight crew preparation for the post-stall recovery task, failure of the stick-shaker system 
to provide adequate time margin between activation and stall, test standards overemphasis on 
minimum altitude loss that may lead to negative training transfer, lack of regulatory requirements 
for post-stall recognition and recovery training, and inappropriate use/reliance on automation to 
recover from unusual attitude or in-flight situations (Ref. 6). 

Loss of stability and maneuverability can result from an upset condition due to inadvertent 
encounters with hazardous weather conditions such as severe turbulence, convective weather, or 
icing. Recent incidents have highlighted new potential contributors to such upset conditions, 
including high ice water content atmospheric conditions capable of causing ice accretion on vital 
aircraft sensors and inside jet engines, at temperatures colder and altitudes higher than icing was 
previously known to occur (Ref. 4). 

The term “loss of control” suggests the flight crew was unable to control the airplane, and in 
some cases this representation is accurate. However, many LOC-I events involve a scenario in 
which the flight crew failed to properly control a controllable airplane, by losing awareness of 
critical flight path management indications and flying the airplane into an unusual attitude or 
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other departure from the normal flight envelope. This subset of LOC-I events has been generally 
described by the Commercial Aviation Safety Team as loss of airplane state awareness events, 
where airplane state is characterized by attitude state awareness and energy state awareness. 
Thus, loss of control accidents may occur as a result of a lack of attitude awareness (spatial 
disorientation) or a lack of energy state awareness on the part of the flight crew. Loss of attitude 
awareness is typically characterized by an initial “mismatch” that develops between the actual 
airplane attitude (pitch or bank angle or rate) and the attitude perceived by the pilot flying, 
followed by a failure to resolve the mismatch, leading to a loss of control. Loss of energy state 
awareness is typically characterized by a failure to monitor or understand energy state indications 
(e.g., airspeed, altitude, vertical speed, commanded thrust) and a resultant failure to accurately 
forecast the ability to maintain safe flight. Both types of events typically involve the failure of the 
flight crew to maintain an awareness of critical flight deck indications, leading to a hazardous 
airplane state. 

A sub-category of loss of control events involve accidents and incidents that occur in the 
landing and approach phase of flight. Approach and landing events also include unstabilized 
approaches; that is, approaches where airspeed, rate of descent, aircraft attitude, aircraft 
configuration, or power setting do not meet stabilized approach criteria at the prescribed approach 
point. These accidents often are manifestations of deficiencies that begin in the approach phase or 
even earlier, and they involve high-energy approaches. The most significant threats during the 
approach are fast approach airspeeds, high groundspeeds (not appreciating wind effects), and high 
and/or steep approach above the desired flight path. High energy is the combination of these 
conditions, and early control of energy can reduce these threats. A stabilized approach provides a 
basis for a good landing. It provides the crew with the optimum conditions to flare, land, and stop 
the aircraft. An approach must be stabilized by 1,000 ft in IMC and by 500 ft in VMC. 

The Flight Safety Foundation Approach and Landing Accident Reduction task force cited 
several important contributing factors to this type of loss of control accidents. These include 
unstabilized approaches involving incorrect management of aircraft energy condition (1.e., 
approaches conducted either low/slow or high/fast), failure to recognize the need for and to 
execute a missed approach, and spatial disorientation and visual illusions (visual approaches at 
night typically present a greater risk) (Ref. 3). Avoiding errors in situation awareness and 
situation assessment is a critical factor in preventing loss of control accidents during final 
approach and landing. 


Icing/Ice Detection 


Adverse weather conditions, including storms and icing conditions, significantly reduce the 
capacity and reliability of the air transportation system. Adverse weather also degrades system 
safety. Accumulation of snow, ice, freezing rain, or frost on aircraft surfaces and sensors that 
occurs in-flight or on the ground (i.e., deicing-related) adversely affects aircraft control or 
performance. This issue is of importance to both civil and military aviation. It is also a critical 
issue for all types of aircraft and is particularly important for turboprop aircraft. Research is 
needed to improve the ability to predict and monitor environmental conditions and develop 
aerodynamic designs and techniques that are robust to adverse conditions. Techniques to predict 
and mitigate the impact of adverse environmental conditions on the aircraft operation, including 
validation of icing prediction capabilities, should be improved (Ref. 7). 

The joint government/industry Commercial Aviation Safety Team (CAST) has developed a 
safety enhancement to encourage manufacturers of new turboprop type designs to adapt and 
implement systems that automatically detect the presence of icing conditions that exceed those 
for which the aircraft has been certified including, if feasible, an estimate of accretion rate for 
advisory purposes, and provide annunciation to the flight crew. For current turboprop production 
aircraft and existing type designs, manufacturers should be requested to conduct a study to 
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determine the feasibility of installing systems that automatically detect the presence of icing 
conditions and alert the flight crew. These recommendations apply to all turboprop aircraft 
operated in commercial passenger and cargo revenue service that have nonevaporative ice 
protection systems and nonpowered flight controls (Ref. 8). 

The consequences of operating an airplane in icing conditions without first having thoroughly 
demonstrated adequate handling/controllability characteristics in those conditions are sufficiently 
severe that they warrant a thorough certification test program, including the application of revised 
standards to airplanes currently certificated for flight in icing conditions. Aircraft icing was 
removed from the latest version of the NTSB’s Most Wanted Safety Improvements (Ref. 2); 
however, it is still considered to be an important current and future safety issue. The NTSB does 
not believe that the problem of aircraft icing has been solved, and they still have many open 
safety recommendations on icing. Specific NTSB recommendations for reducing the dangers to 
aircraft flying in icing conditions are to use current research on freezing rain and large water 
droplets to revise the way aircraft are designed and approved for flight in icing conditions, to 
apply revised icing requirements to currently certificated aircraft, and to require that airplanes 
with pneumatic deice boots activate the boots as soon as the airplane enters icing conditions 
(Ref. 9). 


Loss of Separation/Near Midair Collision 


Expected growth in the demand for air transportation will require efficient, denser en route, 
and terminal area operations. This necessitates procedures that reduce minimum spacing 
requirements during all phases of flight and in all weather conditions, through an integrated 
approach that leverages a suite of emerging technologies such as performance based navigation 
and automatic dependent surveillance broadcast (ADS-B). Performance based navigation 
procedures such as required navigation performance (RNP), area navigation (RNAV), optimized 
profile descents, and tailored arrivals for oceanic flights are being developed to increase the 
capacity and efficiency of the National Airspace System as well as to provide environmental 
benefits in terms of reductions in fuel emissions and aircraft noise. The National Science and 
Technology Council (Ref. 4) stated that “reduced aircraft separation will require a move to 
trajectory-based operations, performance-based navigation, and a new allocation of 
responsibilities between air and ground and between humans and automation. In addition, 
planned advanced airspace design concepts that can be dynamically adjusted to meet demand 
requirements and avoid hazardous weather conditions must be developed with safety in mind.” 

Trajectory Based Operations (TBO), which involves a shift from clearance-based to 
trajectory-based air traffic control, will provide the capabilities, decision-support tools, and 
automation to manage aircraft movement by trajectory. It will enable aircraft to fly negotiated 
flight paths necessary for full Performance Based Navigation (PBN), taking both operator 
preferences and optimal airspace system performance into consideration. TBO is a cornerstone of 
NextGen; it is an air traffic management system concept that manages aircraft through their 
Four-Dimensional Trajectory (4DT), gate to gate, both strategically and tactically to control 
surface and airborne operations. This represents a major operational transformation for aviation, 
basing safe separation on much higher levels of automation that assesses the current aircraft 
positions, with respect to their future positions in time. 4DTs will be used for planning, 
sequencing, spacing, and separation based on the aircraft’s current and future positions. 
Separation duties will be performed by a combination of airborne and ground-based automation. 

Increasing capacity will depend upon reducing lateral and longitudinal separation standards 
for arrival and departure operations as well as efficiently managing the movements of greater 
numbers of aircraft on the airport surface. To accomplish this while maintaining or improving 
safety, procedures will be needed to efficiently accommodate a large number and wide range of 
aircraft through spacing and sequencing based on aircraft type and equipment rather than a 
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common worst-case standard. New concepts of operation should be evaluated in terms of their 
technological, business, and human factors issues as well as their impact on capacity, safety, and 
the environment. Furthermore, safe, high-capacity operations in a complex future airspace 
environment will require innovative ATM procedures such as simultaneous noninterfering 
operations in which general aviation and rotorcraft are threaded through airspace unused by 
commercial air traffic (Ref. 7). 

Air traffic control is currently a labor-intensive process. FAA controllers, aided by radar, 
weather displays, and procedures, maintain traffic flow and assure separation by communicating 
instructions to aircraft in their sector of responsibility. In many busy terminal areas, system 
limitations constrain the capacity of the air transportation system, resulting in congestion-related 
delays. In the NextGen environment, technologies and procedures to enable reduced separation 
will be deployed. Initiatives to reduce aircraft separation by automating time-critical separation 
assurance tasks and providing automated advisories to air traffic controllers and flight crews are 
being investigated. However, changing the role of the controller from tactical separation to traffic 
flow management and trusting automated systems to manage the tactical separation of aircraft is a 
source of potential risk in the NAS that will require resolution of major human factors, safety, and 
institutional issues (Ref. 7). 

The expected growth in air transportation demand will likely require operators to perform a 
wider range of tasks and to collaborate more closely with one another and with modern 
technologies. For example, pilots may begin to play a more active role in traffic separation or 
spacing and will need to coordinate their activities and intentions with other pilots and 
controllers. With the introduction of technologies like Airborne Separation Assistance Systems 
(ASAS) and Automatic Dependent Surveillance-Broadcast (ADS-B), future flight crews may be 
faced with increased responsibility for separation assurance during all phases of flight (Ref. 10). 
The need to interact and exchange information and to distribute more information in a timely 
manner will become increasingly critical. In order to provide increased utilization of the airspace, 
separation standards may decrease between runways, between aircraft, between landing 
operations, and for vertical separation. The risk of runway incursions may also increase as a 
result. The reliability of technologies and procedures enabling reduced separation must be 
assured. In addition, research into candidate concepts of operations and enabling technologies is 
needed for any change in separation responsibility from ground controllers to the cockpit. 

In the future, air traffic will be composed of a mix of aircraft of different size and speed 
equipped with varying levels of communication and navigation capabilities interacting in 
procedural airspace. Some of the safety issues associated with mixed fleet equipage and 
performance capability include: Loss of separation of mixed technology aircraft sharing same 
airspace (for example, departure separation issues between aircraft equipped for RNAV 
departures and those unequipped); the heightened potential for near midair collisions in complex 
Metroplex environments; and ATC coordination problems and increased controller workload 
when low-technology aircraft are mixed with high-technology aircraft in high-technology 
airspace. This could lead to problems in maintaining situation awareness when there are 
significant gaps in knowledge about other aircraft (e.g., flight path intent information may be 
lacking, or even knowledge that other aircraft exist). Technologies and procedures to manage the 
mix of low- and advanced-technology aircraft within the airspace must be developed or 
low-technology aircraft must be excluded from airspace used by advanced aircraft (Ref. 11). 
While lesser equipped aircraft will still be accommodated in the NAS, ensuring that a significant 
portion of the aircraft fleet is appropriately equipped to take advantage of capacity, efficiency, 
and environmental improvements is a critical issue. However, recognizing that all aircraft will not 
be similarly equipped adds complexity to the task of air traffic service providers and presents a 
future safety challenge for NextGen. 
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Another important safety issue related to this future risk tall pole is the rate of unnecessary 
Traffic Alert and Collision Avoidance System (TCAS) alerts that are experienced in the vicinity 
of various airports in the NAS. TCAS issues Resolution Advisories (RAs) in a number of 
situations in which the aircraft are adequately separated in accordance with air traffic control 
rules and procedures. For instance, in Class B and C airspace, controllers aim to maintain a 
minimum of 500 ft vertical separation between traffic flying under Instrument Flight Rules (IFR) 
and traffic flying under Visual Flight Rules (VFR). TCAS, however, may issue an RA to flights 
with as much as 600 ft of vertical separation. In another example, IFR flights arriving on closely 
spaced parallel runways under visual conditions may get a TCAS RA even if both aircraft are 
adequately separated for the arrival, and neither flight blunders into the other’s path. 

There is also a concern that the currently available versions of TCAS will not be adequate to 
support the traffic levels predicted in NextGen. TCAS II has been very successful in reducing the 
risk of mid-air collisions. However, despite the success of the TCAS program, there remain areas 
for improvement. The limitations have to do with the adaptability and flexibility of TCAS II to 
new users, new operations and separations, and new surveillance sources. The Federal Aviation 
Administration’s Collision Avoidance Program Office is developing an advanced Airborne 
Collision Avoidance System (ACAS), called ACAS X, to support the objectives of the Next 
Generation Air Transportation System Program (NextGen). ACAS X will look to improve on the 
performance of TCAS II—improving safety and reducing unnecessary alerts while providing the 
same procedures and operational interaction as current TCAS. 

A key ICAO Performance Improvement Area involves implementation of the airborne 
collision avoidance system (ACAS) adapted to trajectory-based operations with improved 
surveillance function supported by ADS-B and adaptive collision avoidance logic aimed at 
reducing nuisance alerts and minimizing deviations. The implementation of a new airborne 
collision warning system will enable more efficient operations and future airspace procedures 
while complying with safety regulations. The new system will accurately discriminate between 
necessary alerts and “nuisance alerts”. This improved differentiation will lead to a reduction in 
controller workload as personnel will spend less time to respond to “nuisance alerts”. This will 
result in a reduction in the probability of a near midair collision (Ref. 5). 

One final challenge for the aviation community related to the Loss of Separation/Near Midair 
Collision safety risk in the future operational environment is the introduction of Unmanned 
Aircraft Systems (UASs) into the NAS. UASs must be integrated into a National Airspace 
System that is evolving from ground-based navigation aids to a GPS-based system in NextGen. 
Safe integration of UASs involves gaining a better understanding of operational issues, such as 
training requirements, operational specifications, and technology considerations. 

Operations of military and civilian UASs in shared military, civilian, and special use airspace 
will continue to increase. UASs will also see increasing use in customs, border patrol and law 
enforcement functions. This requires them to be at least as safe as manned aircraft. Potential 
safety issues that may arise with the increased presence of UASs could include close calls and 
near midair collisions between passenger aircraft and UAS and inadequate coordination between 
military and civilian UASs in civilian airspace. 

Unmanned aircraft are flying now in the national airspace system under very controlled 
conditions. Operations potentially range from ground level to above 50,000 ft, depending on the 
specific type of aircraft. However, UAS operations are currently not authorized in Class B airspace, 
which exists over major urban areas and contains the highest density of manned aircraft in the NAS. 
The FAA is currently developing a future path for safe integration of civil UASs into the NAS as 
part of NextGen implementation. The FAA is also working with civilian operators to collect 
technical and operational data that will help refine the UAS airworthiness certification process. 
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The National Research Council (Ref. 7) indicated that research in the following four key 
topic areas is required to support safe integration of UASs in the NAS: 


e Aircraft—Automation, system upgrade issues, and communications systems, all of which are 
distinct from those for manned aircraft. 

e =Human—machine interaction—Function allocation, human interface design, situational 
awareness, training, and required level of proficiency in the remote operation of the aircraft. 

e Maintenance and support—In matters where a UAS differs distinctly from traditional aircraft. 

e =F light operations—Sense- or detect-and-avoid issues, person-to-person interfaces between 
operators and controllers, assurance of positive control of the aircraft (especially with highly 
automated UASs that are not directly controlled by ground-based operators in real time), and 
automated contingency management. 


Human Fatigue 


Fatigue is a cross-cutting issue that does not map to one particular accident category; rather, it 
can be an important contributing factor in all types of aircraft accidents. Generally speaking, 
fatigue is weariness from physical and/or mental exertion that can often result in degradation of 
human performance. It includes both human factors issues and human fatigue issues in design, 
operations, air traffic management, and maintenance, repair, and overhaul. Human fatigue can 
also lead to a loss of situational awareness on the part of pilots or controllers. This may manifest 
itself as a lack of the perception and comprehension of elements in the surrounding environment 
and a lack of projection of their status in the near future. It can result from many factors, 
including inappropriate prioritization of tasks, channeling of attention, and inappropriate 
allocation of tasks between human and automation. It also includes loss of awareness of 
automation status, systems, terrain, traffic, and surrounding environment. Commercial airline 
pilots have identified sleep deprivation, high workload, and circadian rhythm interruption as the 
main factors contributing to their fatigue. The risk of increased fatigue of flight crews in future 
flight operations may occur as a result of either the longer flight duty times associated with ultra 
long-range flights with minimum crew or the heavier workload experienced in regional 
operations (Ref. 10). 

Operating a vehicle without the operator’s having adequate rest, in any mode of transportation, 
presents an unnecessary risk to the traveling public. The NTSB has long been concerned about the 
effects of fatigue on persons performing critical functions in all transportation industries including 
flight crews, aviation mechanics, and air traffic controllers. Until the most recent version of their 
Most Wanted List was released, the issue of fatigue had remained on the NTSB’s list of most 
wanted safety improvements since 1990. Their recommendations on the issue of human fatigue and 
hours-of-work policies have had a substantial effect on encouraging the modal agencies to conduct 
research and take actions towards understanding the complex problem of operator fatigue in 
transportation and how it can affect performance. To reduce accidents and incidents caused by 
human fatigue in the aviation industry, the NTSB has recommended that the FAA should issue 
regulations that establish scientifically based duty time limitations for air carrier maintenance 
personnel and flight crews (Ref. 9). 

Fatigue threatens aviation safety because it increases the risk of pilot error that could lead to 
an accident. Acting to address this critical safety concern, the FAA issued a final rule in 
December 2011 that overhauls commercial passenger airline pilot scheduling to ensure pilots 
have a longer opportunity for rest before they enter the cockpit. This rule amends the FAA’s 
existing flight, duty, and rest regulations applicable to Part 121 certificate holders and their flight 
crew members. The rule recognizes the universality of factors that lead to fatigue in most 
individuals and regulates these factors to ensure that flight crew members in passenger operations 
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do not accumulate dangerous amounts of fatigue. These new regulations, while intended to 
mitigate the effects of fatigue, acknowledge that human fatigue remains an important area of 
safety risk that needs to be addressed and monitored. Key components of this final rule for 
commercial passenger flights include (Ref. 12): 


e Varying requirements based on the type of flight and time of day it begins—The new rule 
incorporates the latest fatigue science to set different requirements for pilot flight time, duty 
period, and rest based on the time of day pilots begin their first flight, the number of 
scheduled flight segments, and the number of time zones they cross. 

e Flight duty period—The allowable length of a flight duty period depends on when the pilot’s 
day begins and the number of flight segments he or she is expected to fly, and ranges from 
9 to 14 hr for single crew operations. The flight duty period includes the period of time before 
a flight or between flights that a pilot is working without an intervening rest period. 

e Flight time limits of 8 or 9 hr—The FAA limits flight time to 8 or 9 hr depending on the start 
time of the pilot’s entire flight duty period. 

e 10-hr minimum rest period—The rule sets a 10-hr minimum rest period prior to the flight 
duty period, a 2-hr increase over the previous rules. 

e Newcumulative flight duty and flight time limits—The new rule addresses potential 
cumulative fatigue by placing weekly and 28-day limits on the amount of time a pilot may 
be assigned any type of flight duty. The rule also places 28-day and annual limits on actual 
flight time. It also requires that pilots have at least 30 consecutive hours free from duty on a 
weekly basis. 

e Fitness for duty—The FAA expects pilots and airlines to take joint responsibility when 
considering if a pilot is fit for duty, including fatigue resulting from pre-duty activities such 
as commuting. If a pilot reports he or she is fatigued and unfit for duty, the airline must 
remove that pilot from duty immediately. 


Recognizing that prior recommendations dealt primarily with flight and duty time 
regulations, the NTSB has also recommended that the FAA oversee the implementation of a 
fatigue management system that would address the problems associated with fatigue in an 
operational environment and take a comprehensive, tailored approach to the problem of fatigue 
within the industry. A fatigue management system encompasses much more than just setting 
guidelines or standards concerning duty, flight and rest periods. As envisioned by the NTSB, a 
fatigue management system incorporates various strategies to manage fatigue, such as scheduling 
practices, attendance policies, education, medical screening and treatment, rest environments, and 
commuting policies (Ref. 9). In response to this recommendation and due to a continuing concern 
with pilot fatigue, Congress mandated a Fatigue Risk Management Plan (FRMP) for all airlines in 
2010, and the carriers have developed these plans based on FAA guidance materials. A FRMP 
provides education for pilots and airlines to help address the effects of fatigue, which can be 
caused by overwork, commuting, or other activities. Airlines will be required to train pilots about 
the potential effects of commuting. An airline may develop an alternative way of mitigating 
fatigue based on science and using data that must be validated by the FAA and continuously 
monitored (Ref. 12). 

In addition to the effects of fatigue on flight crew members, it is also a significant safety issue 
for aviation maintenance personnel and air traffic controllers. As result of increased financial 
pressure on airlines over the last 10 to 15 years, there have been changes in the way maintenance 
organizations conduct their work. The number of maintenance employees per aircraft has been 
reduced significantly, even taking into consideration that the present fleet demands less 
maintenance due to increased quality and more efficient maintenance programs. Due to tight 
daytime flight schedules, there is growing use of nightshift operations for critical maintenance 
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tasks, thus increasing the likelihood of fatigue and maintenance errors. In addition, contract 
maintenance personnel have economic incentives to seek out overtime to maximize their income 
(Ref. 11). For air traffic controllers, the NTSB believes it is necessary to revise controller 
work-scheduling policies and practices to provide adequate rest periods, modify controller shift 
rotations to minimize fatigue, and develop a fatigue awareness and countermeasures training 
program for controllers (Ref. 9). 


Increasing Complexity and Reliance on Automation 


Automation, as a concept, is the allocation of functions to machines that would otherwise be 
allocated to humans. The term is also used to refer to the machines that perform those functions. 
Flight deck automation, therefore, consists of machines on the commercial transport aircraft flight 
deck that perform functions otherwise performed by pilots. Current flight deck automation 
includes autopilots, flight path management systems, electronic flight instrument systems, and 
warning and alerting systems. With the advent of advanced technology, the so called “glass 
cockpit”, commercial transport aircraft and the transfer of safety-critical functions away from 
human control, pilots, scientists, and aviation safety experts have expressed concerns about the 
safety of flight deck automation (Ref. 10). 

Commercial transport aircraft flight deck automation has been well received by pilots and the 
aviation industry as a whole. Accident rates for advanced technology aircraft are generally lower 
than those of comparable conventional aircraft. However, the nature of the functionalities of 
automation has been continuously evolving. Increasingly, aircraft systems are being designed to 
automatically reconfigure themselves in the event of system failures without notifying the crew of 
early trends indicating anomalous component performance. In the future, greater expectations for 
more efficient management of air traffic will drive increasingly advanced automation. A major 
concern is the increasing reliance by flight crew, air traffic controllers, maintenance, and dispatch 
on the proper functioning of the advanced automation. Flight crews also rely on automation for 
proper management of off-nominal and failure scenarios. Some of the safety concerns associated 
with the increasing complexity and reliance on automation include (Ref. 11): 


e The flight crew may spend excessive time in a monitoring role, potentially compromising 
their ability to intervene when necessary. 

e Failure of the flight crew to remain aware of the automation mode and aircraft energy state. 

e Pilots may place too much confidence in the automation and, consequently, may lose manual 
flying skills. 

e Unfamiliar modes of aircraft automation may result in a perfectly normal flying aircraft 
suddenly taking on characteristics that the pilot has seldom or never previously encountered. 

e Pilots may not be adequately trained to understand the philosophy of the automation design 
and in important situations of degraded automation functionality. 


In addition, there is a safety concern that the proliferation of advanced automation 
caution/warning systems and alerts could overwhelm the perceptual and cognitive abilities of the 
flight crew in critical phases of flight, causing an increase in flight crew workload and decreased 
situational awareness. 

Increasing pressure to replace humans with automated systems may characterize future 
design philosophies. There may be an increasing need to adequately design systems from the start 
to take advantage of human flexibility and creativity and to augment human abilities and 
limitations with computers. This has been (and is still) the focus of many activities (human- 
machine interface, cockpit design, autopilot and Flight Management System (FMS) certification 
criteria). Methodologies are being developed by manufacturers with the participation of human 
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factor specialists. There may be a greater likelihood that crews will unconsciously relinquish 
command responsibilities momentarily to automated systems. The unknown effects of aircraft- 
pilot coupling may result in a perfectly normal flying aircraft suddenly taking on characteristics 
that the pilot has seldom or never previously encountered. 

The ever-increasing demand for air transportation, combined with the rapid pace of 
technological change, poses significant challenges for effective integration of humans and 
automation. With the increasing reliance on and complexity of flight deck automation, a better 
understanding of the causes of human error and of human contributions to safety is needed. In 
complex and highly automated aircraft, flight crews can lose situational awareness of the 
automation mode under which the aircraft is operating or may not understand the interaction 
between a mode of automation and a particular phase of flight or pilot input. Situations such as 
these can lead to the crew’s mismanagement of the energy state of the aircraft or to the aircraft’s 
deviation from the intended flight path for other reasons. Design guidelines should be developed 
that will help minimize the potential for design-induced error and facilitate positive human 
intervention in the event of system failures. The emphasis of air carrier policies and procedures 
should be to help minimize the frequency with which flight crews induce automation errors and 
to help flight crews recognize and correct automation errors in a timely fashion, regardless of the 
source of the error (Ref. 13). 

The layout and function of cockpit displays controls are designed to increase pilot situation 
awareness without causing information overload. Traditionally, the major demands placed on a 
pilot were associated with the task of flying the aircraft; however, as levels of cockpit complexity 
increase, the focus has changed away from skill-based to knowledge-based tasks, and the role of 
the pilot is centered on the processing of information. This information may be presented in a 
number of different formats, in the auditory or visual modality for example, containing either 
verbal or spatial information, and pilots may interact with cockpit systems from numerous 
interfaces. New sources of safety risk may be introduced as flight crews are required to interact 
with an increased amount of information. Among these are: Crew distraction resulting from 
information being presented on supplementary displays, requiring the crew to divide their 
attention; flight crew confusion resulting from multiple modes being annunciated at one time; and 
the potential for information overload and excessive workload. The sheer volume of information 
available and the confusion it causes may become major contributors to serious accidents and 
incidents (Ref. 11). 

According to the National Research Council’s Decadal Survey of Civil Aeronautics (Ref. 7), 
research on human-machine integration technologies for vehicle applications should include the 
following: 


e Develop and test enabling technologies for pilot workload management and reduced crew 
operations (e.g., improved human-machine integration for a flight management system) 
while keeping pilot awareness at the proper level. 

e Develop display concepts for maintaining operator situational awareness while monitoring 
highly automated processes. Demonstrate the ability of operators to rapidly and accurately 
intervene in the event of system failures. 

e Develop technologies and/or display concepts enabling effective fusion of information from 
multiple sources. 
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Vulnerability Discovery Through Data Sharing and Dissemination 


Through the collection, analysis, and dissemination of relevant data, decision makers 
throughout industry, air navigation service providers (ANSPs), and regulatory authorities will be 
able to proactively implement changes that have a positive effect on safety. Nonetheless, it is 
commonly recognized that these organizations have historically collected a significant amount of 
data without having established common taxonomies or appropriate governance to facilitate the 
sharing of valuable safety data. Consequently, the industry as a whole is data rich and information 
poor. IATA has been working with key airlines, ANSPs, and airport and regulatory authorities to 
create a global data collection process, providing the ability to accurately measure and benchmark 
safety occurrences and therefore create effective mitigation strategies appropriate for airlines 
operating in specific regions. 

Safety data provide the basis for discovering vulnerabilities in the air transportation system. 
The following issues must be addressed for future safety benefits to be attained by preventing 
potential vulnerabilities from becoming accidents (Ref. 6): 


Inadequate dissemination of flight-critical information within the organization. 

Failure to share significant data between airlines/operators. 

Failure to disseminate critical information between manufacturers. 

Lack of formalized threat-free information reporting from operators to manufacturers. 

Insufficient collection of incident data. 

Failure of regulators to disseminate critical flight safety information to flight crews. 

Timely flight safety information not shared between validating authority and certificating 

authority. 

e Failure of the airline/operator and ATC processes to identify and stress the criticality of 
self-reporting of incidents and safety issues by operational personnel. 

e Assure operational personnel that the data they provide will be protected and not used for 

punitive action. 


The current air transportation system has reached a state where low accident levels for 
commercial aviation, coupled with the traditional forensic investigation approach to aviation 
safety, are yielding fewer insights capable of significantly improving aviation safety (Ref. 4). 
Thus, traditional methods of historical or forensic review of accident data cannot be relied upon 
as the sole predictor of risk and future events. As the number of accidents and serious incidents 
decreases due to better design, better hazard elimination, and risk mitigations, more attention will 
be needed on identification of subtle system-level issues and anomalies in order to be able to 
predict future safety issues before they lead to serious accidents or incidents. Advances in 
prognostic techniques enable insights into system safety through examination of large numbers of 
normal operations, as well as incident events. 

In the National Aeronautics Research and Development Plan (Ref. 4), the National Science 
and Technology Council recommends two data analysis objectives aimed at reducing accidents 
and incidents by identifying system-wide safety risks through research on prognostic 
methodologies capable of organizing, managing, and mining data from all users in the entire 
airspace system. The first recommendation is to develop advanced methods to automatically 
analyze textual safety reports and extract system performance information for prognostic 
identification of safety risks for system operators and designers. Secondly, fundamentally new 
data-mining algorithms should be developed to support automated data analysis tools to integrate 
information from a diverse array of data resources (numeric and textual) to enable rapid 
prognostic identification of system-wide safety risks. These research objectives will organize and 
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manage data from all users in the entire airspace system and mine those data to actively identify 
safety risks to the affected users, rigorously integrating both objective statistical techniques and 
operator reports of safety concerns. 

There is an increasing need to monitor incident and accident precursor trends and identify 
nonstandard performance. Proliferation of hardware and software tools to monitor performance of 
aviation systems is being introduced to fill this need. Advanced systems for entering, storing and 
disseminating safety critical data for use in electronic, automated and computerized flight systems 
are appearing. Since there are few commercial aviation accidents and fewer common causes, 
more data points are needed. Voluntary programs such as the Aviation Safety Action Program 
(ASAP), Flight Operations Quality Assurance (FOQA) program, and the Air Traffic Safety 
Action Program (ATSAP) give airlines and the government insight into millions of operations so 
that potential safety issues and trends are identified. The Aviation Safety Information Analysis 
and Sharing (ASIAS) program connects 46 safety databases across the industry and is integrated 
into the joint government/industry CAST process (Ref. 14). The program is evolving but has 
matured to the point that the FAA can now look at data from air carriers representing 92 percent 
of U.S. commercial operations and identify emerging vulnerabilities and trends. Safety 
improvements are made not only through FAA regulations, but also through CAST. 

Proactive safety management and integrated safety cases allow the early identification of 
problems and the analysis of trends so that preventive measures are put in place before any 
accidents can occur. FAA’s ASIAS program provides a suite of tools that extract relevant 
knowledge from multiple, disparate sources of safety information. ASIAS also helps the FAA and 
industry monitor the effectiveness of safety enhancements (Ref. 15). ASIAS has suggested that as 
aircraft become more complex, there is a need for standard logical frame layouts in aircraft data. 
Also, there is a need for global sharing of data and for standardization of collecting data and 
common taxonomies for textual data. Finally, improving the quality and dissemination/sharing of 
regional jet, rotorcraft, and general aviation data and safety information is needed. 


Enhanced Survivability in the Event of an Accident 


Enhancing and protecting the safety of passengers, crews, and ground personnel in the event 
of an accident is a key research challenge to improving aviation safety. The research can be 
broken into two categories: (1) improving crash survivability of aircraft structures; and 
(2) improving evacuation and accident response procedures. At present, nearly half the aircraft 
fatalities in impact-survivable accidents are due to the effects of smoke and fire (Ref. 4). 
Research into understanding and reducing flammability of aircraft interiors is essential to making 
impact accidents survivable for crew and passengers, as well as firefighters. Post-impact fire and 
evacuation were two safety concerns expressed by several organizations providing input to the 
Aviation Safety Issues Database (Ref. 6). Accidents and incidents related to evacuation were 
defined as occurrences where either person(s) are injured during an evacuation, an unnecessary 
evacuation was performed, evacuation equipment failed to perform as required, or the evacuation 
was a factor in the outcome. 

While significant progress has been made to mitigate the catastrophic effects of post-impact 
fires and structural damage, this remains an issue of concern for aviation safety. And with the 
introduction of alternative fuel technologies and advanced composite and metallic materials, 
enhancing post-accident survivability will continue to be a future safety risk area. Future aircraft 
will be made from advanced, novel materials, in more complex configurations, with more 
technically advanced subsystems and avionics. When accidents do occur, it is imperative that the 
probability of survival for the passengers and crew on board be as high as possible. Modern 
airplanes like the Boeing 787 are increasingly made of carbon fiber, which burns faster than the 
traditional aluminum and produces more toxic smoke. Research into understanding the 
flammability of alternative fuels and smoke toxicity of advanced aircraft materials is needed. 
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Restraint systems integrated into and as strong as the supporting aircraft structure offer the 
possibility of providing increased occupant survivability; research into these systems is essential. 
Lastly, research on current and future evacuation and accident-response procedures will ensure 
that new aircraft entering the airspace system are as safe as, or safer than, today’s aircraft (Ref. 4). 
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